CVE-2024-37278: 
WordPress vulnerability analysis and mitigation

A Cross-Site Scripting (XSS) vulnerability was discovered in the Cards for Beaver Builder WordPress plugin, affecting versions through 1.1.4. The vulnerability was reported on June 18, 2024, and publicly disclosed on June 28, 2024. This security issue was assigned CVE-2024-37278 and involves improper neutralization of input during web page generation (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). It received a CVSS v3.1 base score of 5.4 (Medium) from NIST with a vector string of CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, while Patchstack assessed it with a slightly higher score of 5.9 (Medium) with vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L. The vulnerability requires editor-level privileges to exploit (NVD).

The vulnerability could allow a malicious actor with editor-level access to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website. These injected scripts would be executed when visitors access the affected site (Patchstack).

The vulnerability has been fixed in version 1.1.5 of the Cards for Beaver Builder plugin. Users are advised to update to version 1.1.5 or later to remove the vulnerability. Patchstack users have the option to enable auto-update for vulnerable plugins (Patchstack).